Laravel Social Auto Post Laravel Package

Product Decisions This Supports

• Reliability commitments and roadmap confidence. v2.6.0's RetryableException / RateLimitException split means transient failures (5xx, network timeouts) now retry automatically with exponential backoff and random jitter, while 4xx errors fail fast. A PM can factor this into published expectations: fewer user-visible "post failed" states, no wasted minutes on unrecoverable errors, and no thundering-herd spike against a partner API during an outage.
• Security and compliance sign-off. The new SafeMediaFetcher adds SSRF protection for remote media downloads, including DNS-rebinding defense (validating all A/AAAA records) and IPv6 zone-identifier filter bypass prevention. This is the kind of control that unblocks enterprise security questionnaires, vendor reviews, and procurement — treat it as a sales-enablement and risk-reduction item, not just a patch.
• Build vs. buy. Reliable retry semantics and hardened remote-fetch logic are undifferentiated heavy lifting. Adopting this package avoids owning that code, its edge cases, and its CVE surface internally.
• Media size as a product lever. The removal of downloadFile() in favor of downloadMediaToTempFile() (robust memory management, OOM prevention) means the team can raise maximum upload/media size limits as a user-facing feature without inviting worker crashes.
• Faster channel expansion. Shared validateTextUrl() and validateMediaInput() in the base SocialMediaService reduce per-platform logic duplication, shortening the estimate for adding the next social channel on the roadmap.

When to Consider This Package

Adopt when: you run Laravel/PHP, post user-supplied or partner-supplied media to third-party social APIs, need multi-platform coverage, and have queue workers available for retry/backoff to be meaningful.

Evaluate carefully if:

• Upgrade cost applies. This is a breaking release. SocialMediaService::downloadFile() is fully removed (previously deprecated), SafeMediaFetcher::execute() is now private, and the $fetchHandler test backdoor is gone. Any custom service extending the base class, any internal test harness stubbing $fetchHandler, and any direct execute() caller must migrate to downloadMediaToTempFile() and the fetch() wrapper. Scope this as an explicit engineering task with a grep pass and test-suite rework before committing to a release date.
• You only integrate one platform with a mature official SDK — the abstraction may cost more than it saves.
• You do no remote media fetching — the SSRF hardening, the centerpiece of this release, delivers little value.
• You are pinned to older PHP/Laravel versions, or need synchronous, non-queued posting where retry/backoff cannot operate.

How to Pitch It (Stakeholders)

To executives: This release materially lowers two categories of business risk at no additional license cost — reliability (automatic recovery from transient partner-API failures, with fast failure on errors that will never succeed) and security (hardened defenses against server-side request forgery when fetching remote media, a common attack path in any product that ingests user-supplied URLs). It also supports larger media uploads without memory-crash incidents, and reduces the effort to add new social channels. The tradeoff is a one-time engineering migration: two removed/deprecated internal methods require code and test updates before we upgrade.

To engineering: v2.6.0 is a breaking change plus a security hardening release. Retry behavior is now split by exception type — verify your job retry and queue configuration aligns, and confirm alerting distinguishes fail-fast 4xx from exhaustively-retried 5xx. Migrate all downloadFile() callers to downloadMediaToTempFile(), stop calling SafeMediaFetcher::execute() directly, and replace $fetchHandler-based test doubles with HTTP fakes. Add regression coverage for SSRF edge cases (DNS rebinding, IPv6 zone identifiers) since those defenses are now load-bearing.